The Cyber Attack Kill Chain: Where Threat Intelligence Can Help

Key Takeaways

• Many people believe threat intelligence is primarily about identifying attacks before they happen. In reality, it’s much more about raising your organization’s security profile against all incoming attacks.
• Different types of threat actors select targets in very different ways. As a rule, the more specific their targeting process, the harder it will be to collect threat intelligence at the pre-planning stage.
• While threat intelligence can add value at every stage of the kill chain, it’s typically in the form of malicious IP/domain/hash lists and post mortem attack analyses.
• It’s not just about incident response. In order to add maximum value, threat intelligence should be made available across your security function.
• Without context, threat intelligence quickly becomes unmanageable. Ensure you’re providing your threat analysts with the tools they need to operate effectively.

Before you start gathering threat intelligence, you must answer a simple question: “What am I trying to achieve?”

The obvious answer is “an improved cyber security profile,” but if you really want to maximize your return on investment you’ll need to be much more specific.

Cyber security is a tremendously complex operation, with many moving parts, so in order to be maximally useful your threat intelligence program must deliver intelligence that can be used to mitigate or prevent specific cyber attacks.

But cyber attacks are complex affairs in their own right. It’s not simply a case of picking a target and attacking it, the cyber attack kill chain is an established and often lengthy process, with multiple phases.

In a recent webinar with Recorded Future and Infosecurity Magazine, KPMG’s Cyber Security Operations Manager Konrad Smelkovs covered the cyber attack kill chain in detail, and explained at which points he felt threat intelligence was most valuable.

Threat Actors: An Overview

Before we look at the kill chain, it’s important to have an understanding of threat actor types.In a previous article, we explained how threat actors can be split into four primary types. During the webinar, however, Konrad went a step further and split threat actors into six categories.

Follow this link to read more https://www.recordedfuture.com/cyber-attack-kill-chain/